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Description 

[0001] This invention relates to document forgery protection systems and methods. 

[0002] Various techniques are known for detecting and/or deterring forgery of an original printed document. Document 

5 forgery includes both unauthorized alteration of the original document and unauthorized copying of the original document. 
Previously, watermarks have been applied to documents to detect and/or deter forgery. Watermarks are printed marks 
on a document that can be visually detected or detected using special equipment. Fragile watermarks are marks that 
appear in an original printed document but that will not appear in a copy of the original document made on a standard 
photocopier or will be detectably degraded in the resulting copy of the document. 

10 [0003] Robust watermarks are marks in an original document that will be accurately reproduced on any copy of the 
original document made on an standard photocopier so that information contained in the watermark can be extracted 
from the copy. There are two types of robust watermarks that can be used. The first type of robust watermark is a mark 
that appears on both the original document and a copy. The second type of robust watermark is a mark that is present, 
but that is not readily visible, on the original document, but that becomes clearly visible on a copy of the original document. 

15 The second type of robust watermark is also known as an invisible robust watermark. 

[0004] Forgery of an original document containing a fragile watermark by copying the original document is easily 
detected by the absence of the watermark on the copy of the original document. Forgery of an original document 
containing the first type of robust watermark is detected by extracting information contained in the robust mark. 
[0005] This information could identify a custodian of the original document and information relating to copy restrictions 

20 or other restrictions as to the use of the information in the original document. Forgery of an original document containing 
the second type of robust watermark is detected by the visible presence of the watermark on the copy of the original 
document. For example, the information contained in the second type of robust watermark could be a banner that reads 
"This is a copy" or a similar warning. 

[0006] WO-A-99/41 900 describes a system for distributing digital representations by including a watermark in the form 
25 of a secret fingerprint in the digital representation before it is encrypted and sent to a client. The fingerprint watermark 
identifies the user to whom the copy is being sent. This is a relatively simple approach but it does not take account of 
the variations in user capabilities in printing genuine documents provided with watermarks. 

[0007] In accordance with a first aspect of the present invention, a document forgery protection printing method 
comprises processing an image of a document; 

30 determining forgery protection requirements for the document to be printed; 

determining a protection level to be applied to the document based on the determined forgery protection requirements; and 
based on the determined protection level, printing at least. one watermark on the document that corresponds to the 
determined protection level using a printer and is characterised in that the forgery protection requirements for the doc- 
ument to be printed are determined from a set of different potential requirements; 

35 in thatthe protection level is determined from a set of different protection levels based on the determined forgery protection 
requirements; and 

in thatthe method further comprises selecting a printerfrom a plurality of printers that can printthe document in accordance 
with the required level of protection and using the selected printer to print the at least one watermark. 
[0008] In accordance with a second aspect of the present invention, a document forgery protection printing system 
40 comprises at least one image processor that processes an image of a document including at least one page; 

at least one server having a print management system adapted to implement a policy that determines a forgery protection 
level for the document in accordance with forgery protection requirements for the document; 

a plurality of printers, each printer able to print the document and able to apply at least one protection level to the 
document by printing at least one watermark including copy evidence and tracing information on the document that 
45 corresponds to the determined protection level and is characterised in that said policy is adapted to determine the forgery 
protection requirements for the document from a set of different potential requirements; 

in that the protection level is determined from a set of different protection levels based on the determined forgery protection 
requirements; and 

in that said print management system is adapted to select a printerfrom the plurality of printers in accordance with the 
50 required level of protection. 

[0009] This invention provides systems and methods for adding fragile and robust watermarks to an original document 
as it is printed. 

[0010] This invention separately provides systems and methods for printing a document requiring forgery protection 
using a number of trusted printers. 
55 [0011] This invention separately provides a series of trusted printers that together permit differing levels of forgery 
protection to be provided to a document to be printed. 

[0012] In accordance with various exemplary embodiments of the systems and methods according to this invention, 
a family of trusted printers is managed to provide a range of different forgery detection and deterrence techniques. The 
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protection requirements for an original document to be printed are determined by a trusted printing policy. The factors 
used to determine the protection requirements required for the original document to be printed include the value of the 
document being created, assumptions about the resources available to an adversary or attacker, such as a potential 
forger, and the cost of providing the protections to the original document to be printed. 

[0013] When an original document requiring forgery protection is to be printed, the print job for that document is routed 
to a trusted printer that can print a watermark that includes copy evidence and/or tracing information necessary to obtain 
the required level of protection. Copy evidence is evidence that can be obtained through an inspection of a document 
that indicates whether that particular document is an unauthorized copy of an original document. Tracing information is 
information printed on a document that identifies the custodian(s) of the original document and restrictions on further 
copying that apply to the custodian(s) and to the original document. Other information may also be included in the tracing 
information that serves to more uniquely identify the original. The required copy evidence is applied to the printed 
document through the use of fragile watermarks or robust watermarks. The required tracing information is applied to the 
printed document through the use of robust watermarks. The parameters of the selected trusted printer are set by a print 
management system to print the watermark(s), including the copy evidence and/or tracing information, appropriate to 
the required level of protection. 

[0014] These and other features of the invention will be described in or are apparent from the following detailed 
description of various exemplary embodiments of systems and methods according to this invention. 
[0015] Particular embodiments in accordance with this invention will now be described with reference to the accom- 
panying drawings; in which:- 



Fig. 1 is a schematic diagram illustrating a print management system according to this invention; 

Fig. 2 is a flowchart of a document forgery protection printing method according to an exemplary embodiment of 

this invention; 

Fig. 3 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 4 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 5 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 6 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 7 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 8 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 1 0 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; and 

Fig. 11 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention. 



[0016] Fig. 1 is a schematic diagram illustrating a system for policy based printing. A network 100 includes at least 
one server 110 that controls a plurality of computers 121, 122 and 23. The server 110 also controls a family 130 of 
trusted printers 1 31 -1 35. A trusted printer is a printer that is available only to authorized users of the network 1 00. The 
server 110 includes an operating system 1 1 1 that allows users of the network 100 to use various applications stored in 
the server 1 1 0 on the computers 121, 1 22 and 1 23. The applications may include, for example, word processing appli- 
cations, spreadsheet applications, image scanning and/or processing applications, and/or database management ap- 
plications. Authorized users of the computers 121, 122 and 23 can use the applications stored in the server 1 10 and 
controlled by the operating system 1 1 1 to create documents 1 40. The applications process images of the document 1 40 
that can be viewed on the display units 151, 152 and 153 of the respective computers 121, 122 and 123. 
[0017] The document 140 can be printed by entering a print command into one of the computers 121 or 122 or 123 
and sending a print job to the server 110. The operating system 111 includes a print management system 112 that 
selects one of the family 130 of the trusted printers 131-135 that can provide a required level of protection for the 
document 1 40 to be printed. The print management system 1 1 2 includes a policy 1 1 3 that maps the document protection 
requirements to the specific security protection techniques available from the family 1 30 of the trusted printers 1 31 -1 35. 
[001 8] The policy 1 1 3 determines the required protection level for the document 1 40 to be printed by collecting infor- 
mation about the value of the document 140 from the document creator or owner or from any other person authorized 
to print the document 140. The information may include assumptions about potential forgery and the cost necessary to 
provide a level of protection to detect and/or deter the potential forgery. The user may enter the information about the 



EP 1 209 897 B1 



document 140 through a graphical user interface provided on one of the display units 151 -153 of the particular computers 
121-123 being used to print the document 140. 

[001 9] The print management system 1 1 2 may also allow the users to question each of the trusted printers 1 31 -1 35 
to determine what protection level each trusted printer 131-135 provides. The print management system 112 may also 
provide information to the user about which forgery techniques each protection level is able to detect and/or deter and 
the costs of using each protection level. Each computer 121-123 may be controlled by the print management system 
112 and/or the operating system 1 1 1 to display to users the protection levels that may be applied to the document 140 
to be printed. 

[0020] Each document 140 to be printed may also have a security level embedded in it, attached to it or otherwise 
associated with it, that the print management system 112 can use to identify the specific combination of protection 
techniques needed to detect and/or deter potential forgery. The policy 1 1 3 is programmable and may be adapted to the 
particular requirements of the organization that operates, owns or uses the network 100. The policy 113 may be pro- 
grammed to assign a protection level or levels for every authorized user of the network 1 00 or for every computer 1 21 -1 23 
of the network 100. 

[0021 ] Every user of the network 1 00 may have an identification that is programmed into the policy 1 1 3. The identification 
may be a login password or user identification. Every document 140 printed by the user identified by the identification 
may have be assigned a specified protection level, a minimum protection level and/or a maximum protection level. 
[0022] Every computer 121-123 of the network 100 may have an identification value. The computer identification 
values may be programmed into the policy 113. Every print job sent by the identified one of the computers 121-123 to 
the server 110 may have a specified protection level, a minimum protection level and/or a maximum protection level. 
The policy 113 determines the protection requirements for the document 140 to be printed by identifying the user that 
enters the print command and/or the computer 1 21 -1 23 that sends the print job. 

[0023] The policy 113 may also conduct a search of the content of the document 140 to determine the required 
protection level. The search could be, for example, a keyword search or a keyphrase search of the document 40. The 
protection requirements of the document 1 40 could be dependent on the number of occurrences of various ones of the 
keywords or keyph rases. 

[0024] The policy 113 determines the security requirements for the document 140 to be printed. For example, the 
policy 1 13 may determine that the document 140 to be printed requires protection against forgery by copying using a 
standard photocopier. Alternatively, the policy 1 13 may determine that the document 40 to be printed requires protection 
against scanning, image processing, and alteration of the contents of the document 1 40. Once the policy 1 1 3 determines 
the security requirements, the print management system 1 1 2 identifies the specific combination of protection techniques 
needed to meet these requirements. The print management system 1 1 2 then routes the print job to one of the trusted 
printers 131-135 that can apply the appropriate protections and sets the parameters in the selected printer to apply the 
appropriate protection techniques to the document 140. Examples of the protection levels that can be applied to the 
document 140 when it is printed, the forgery techniques that the protection levels protect against and the equipment 
necessary for creating the protection level and verifying the authenticity of a document are described in Table 1 . 



Table 1 



Protection Levels 


Technique(s) 


Protects Against 


Equipment Needed 


Level 0 


Fragile variable copy evident 
watermark. 


Adversary with standard 
copierandtonerorink. Blank 
originals attack. 


Standard color printer, or 
special toner or ink, or 
hyperacuity printer with 
inspector. 


Level 1 


Robust variable invisible copy 
evident watermark with 
tracing information. 


Adversary who can remove 
copy evident watermarks 
from originals. 
Blank originals attack. 
Compromised tracing attack. 


Standard color printer with 
special toner or ink. 


Level 2 


Fragile variable fluorescing 
invisible copy evident 
watermarkto print page offset, 
with tracing information. 


Weak protection against 
tampering. 

Blank originals attack. 


Special toner or ink and 
standard highlight or color 
printer. Enhancements could 
include toner sensor or 
sensorto verify the presence 
of the copy-evident 
watermark. Fluorescent light 
to verify. 
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(continued) 





Protection Levels 


Technique(s) 


Protects Against 


Equipment Needed 


5 
10 


Level 3 


Fragile variable fluorescing 
invisible copy evident 
watermarkto print page offset, 
with tracing information, 
digitally signed and glyph 
encoded. 


Adversary who can scan, 
image process, and print and 
who has access to the 
special toner or ink. 


Special toner or ink and 
standard highlight or color 
printer. Enhancements could 
include toner sensor or 
sensorto verify the presence 
of the copy evident 
watermark. Fluorescent light 
and fluorescent scanner to 
verify. 


15 
20 


Level 4 


Fragile variable fluorescing 
invisible copy evident 
watermark to print random 
portions of the page, with 
tracing information, digitally 
signed and glyph encoded. 


Adversary who can scan, 
image process, and print and 
who has the special toner or 
ink. 


Special toner or ink and 
standard highlight or color 
printer. Enhancements could 
include toner sensor or 
sensors to verify the 
presence of the copy evident 
watermark. Fluorescent light 
and fluorescent scanner to 
verify. 


25 


Level 5 


Robust variable fluorescing 
black copy evident watermark 
with tracing information. 


Adversary with standard 
copier and toner or ink. 
Compromised tracing attack. 


Fluorescing blacktoneror ink 
in a standard highlight or 
color printer. Fluorescent 
light to verify. 


30 


Level 6 


Robust variable fluorescing 
blackcopy evident watermark 
with tracing information to 
print fixed portions of the 


Adversary with standard 
copier and tone or ink. 
Detached toner attack. Blank 
originals attack. 


Fluorescing blacktonerorink 
in a standard highlight or 
color printer. Fluorescent 
light to verify. 


35 


Level 7 


Robust variable fluorescing 
blackcopy evident watermark 
to print random portions of the 
page, with the random pattern 
specification encrypted and 
glyph encoded 


Adversary with standard 
copier and toner or ink. 
Adversary with a scanner 
and image processor. 
Detached toner attack. 
Compromised tracing attack. 


Fluorescing blacktonerorink 
in a standard highlight or 
color printer. Fluorescent 
light to verify. Inspector to 
read and verify the glyph. 


40 
45 


Level 8 


Robust variable fluorescing 
blackcopy evident watermark 
to print content dependent 
portions of the page, with 
tracing information, encrypted 
and glyph encoded 


Adversary who alters tracing 
information. Adversary with 
standard copier and ink. 
Adversary who can scan and 
image process. Detached 
toner or ink attack. 
Compromised tracing attack. 


Fluorescing black toner in a 
standard highlight or color 
printer. Fluorescent light to 
verify. Inspector to read and 
verify the glyph. 



[0025] Although Table 1 shows various watermarking techniques usable either alone or in combination to provide a 
specified level of protection to a document, it should be appreciated that the table is merely one exemplary embodiment 
of a policy 1 1 3. Other combinations of watermarking techniques may be provided to enable a greater range of protection 
levels. The protection levels, the techniques, theforgerymethodsthat are protected against, andthe equipment necessary 
to apply the techniques to a document to be printed and verify if a printed document is an original or a forgery are 
described below. 

[0026] As shown in Fig. 1, the trusted printer 131 can print documents having Level 0 protection, the trusted printer 
132 can print documents requiring Level 1 protection, the trusted printer 133 can print documents requiring Level 0 
through Level 4 protection, the trusted printer 134 can print documents requiring Level 4 through Level 8 protection and 
the trusted printer 135 can print documents requiring Level 7 and Level 8 protection. 

[0027] Fig. 2 is a flowchart of one exemplary embodiment of a document forgery protection printing method according 



5 



EP 1 209 897 B1 



to this invention. Beginning in step S1000, control continues to step S1100, where a user creates a document that 
requires forgery protection. Then, in step S1 200, the user enters a print command to print the document requiring forgery 
protection. Next, in Step S1300, information about the protection levels is displayed to the user. Control then continues 
to step S1400. 

[0028] In Step S1400, information is collected about the value of the document requiring forgery protection. The 
information may include information or assumptions about potential forgery of the document requiring forgery protection 
and the cost of applying the various available protection techniques to the document requiring forgery protection. Next, 
in step S1500, the protection requirements of the document requiring forgery protection are determined based on a 
trusted printing policy. The determined protection requirements for the document requiring forgery protection may indicate 
that this document requires protection against forgery from copying using a standard photocopier or that the document 
requiring forgery protection requires protection against forgery by scanning, image processing and altering of the contents 
of the document. Then, in step S1 600, the protection level that provides the specific combination of protection techniques 
to meet the determined protection requirements is determined. Control then continues to step S1700. 
[0029] In step S1 700, a trusted printer that can apply the appropriate protection techniques to the document requiring 
forgery protection is selected based on the determined protection level. Then, in step S1 800, the print job forthe document 
requiring forgery protection is routed to the selected trusted printer. Next, in step S1900, the parameters in the selected 
trusted printer are set based on the determined protection level. In step S2000, the document requiring forgery protection, 
including the protection techniques of the determined protection level, is printed using the selected trusted printer. Then 
in step S21 00 the method ends. 

[0030] Although one exemplary embodiment of a document forgery protection printing method according to this in- 
vention has been described above with respect to Fig. 2, it should be appreciated that other exemplary embodiments 
of document forgery protection printing methods may be apparent to those of ordinary skill in the art. For example, in 
various exemplary embodiments of the document forgery protection printing method according to this invention, the 
information about the protection levels may be displayed prior to the print command being entered. In other various 
exemplary embodiments of the document forgery protection printing method invention of this invention, the information 
about the value of the document and the potential forgery of the document may also be collected prior to the print 
command being entered . In other various exemplary embodiments of the document forgery protection printing method 
according of this invention, the parameters of the selected trusted printer may be set prior to the print job being routed 
to the selected trusted printer. 

[0031] As shown in Fig. 1 , the trusted printers 131 and 133 can print documents having Level 0 protection. As shown 
in Table 1 , Level 0 protection includes a fragile variable copy evident watermark. As shown in Fig. 3, the content owner, 
who may be anyone authorized to create the document 140, view the document 140, and/or print the document 140, 
provides image data from an image data source, which may be one of the computers 121-123 or an external data storage 
device, to an image processor, which may be an application stored on the server 1 1 0, to create the document 1 40. Copy 
evidence is also provided to the image processor and included with the contents of the document 1 40. The copy evidence 
included in the document 140 can vary with the page of the document 140 and could include information identifying the 
contents of the page, the page number or identifier, the author, the document title, the date, the time, and the originating 
organization. The copy evidence could also include characteristics about the trusted printer 131 or 1 33 or a unique copy 
number recorded by the trusted printer 131 or 1 31 . The copy evidence may be provided by the content owner through 
a graphical user interface provided on one of the display units 151-153 of one of the respective computers 121-123, or 
may be determined automatically by the operating system 111, the print management system 1 12, and/or the policy 
1 1 3. The copy evidence is encoded in a fragile variable copy evident watermark. Because the copy evidence varies with 
each page of the document, the fragile variable copy evident watermark varies with each page. 
[0032] The fragile variable copy evident watermark of Level 0 may be formed by any known technique for forming 
fragile watermarks. Techniques for forming fragile watermarks include, for example, microvariations in ink density within 
the letters, extremely small glyphs contained in the letters, very small marks ortextures, possibly in color, that are printed 
on the background or one or more unused portions of the sheet of recording material that the document is printed on 
that are made to appear as shading or fibers in the sheet of recording material, hyperacuity pixels within characters of 
text, and serpentones within color or black and white images. 

[0033] If the policy 1 1 3 determines that the security requirements for the document 1 40 to be printed require a fragile 
variable copy evident watermark, the print management system 112 routes the print job to either trusted printer! 31 or 
133. The print management system 1 12 also sets the parameters in the trusted printer 131 or 133 to print the fragile 
variable copy evident watermark. 

[0034] The fragile variable copy evident watermark may be made more difficult to forge by encoding the copy evidence 
in the fragile variable copy evident watermark so that the information can only be decoded by a secret key contained in 
the trusted printer 131 or 133 or belonging to the content owner. The copy evidence contained in the fragile variable 
copy evident watermark may also depend on unique physical characteristics of the trusted printer 1 31 or 1 33. For example, 
a random pattern may be applied to the document by the trusted printer 31 or 33 as disclosed in U.S. Application Serial 
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No. 09/504,036. Copy evidence unknown to an adversary, such as a forger, could also be encoded in the fragile variable 
copy evident watermark or the fragile variable copy evident watermark could be printed using methods that are difficult 
or very expensive to reproduce such as, for example, spectral modulation. 

[0035] As shown in Table 1 , the trusted printer 131 or 133 may be a standard color printer or a standard printer provided 
with special toner or ink, such as, for example, fluorescing or magnetic toner or ink. The trusted printer 131 or 1 33 may 
also be a hyperacuity printer that can print serpentones. An inspector device may be used to verify the presence of the 
serpentones, or the presence of the special toner or ink. The inspector device can also read the contents of the fragile 
variable copy watermark. Such printers and inspector devices are disclosed in US-A-5,706,099 and US-A-5, 71 0,636. 
[0036] As shown in Fig. 3, the trusted printer 131 or 1 33 prints the document 1 40 on standard paper. Standard paper 
is paper that does not necessarily have a preprinted watermark. As shown in Fig. 3, a document 140 printed with the 
fragile variable copy evident watermark of Level 0 is protected against an adversary having access to the original printed 
document and a standard photocopier with standard toner or ink. A visual inspector can verify if a document is an original 
or a forgery. The visual inspector may be any person authorized to inspect documents for authenticity. A document is 
verified as an original by the undistorted appearance of the fragile variable copy evident mark. A document is established 
as a forgery by the absence, or the discolored appearance, of the fragile variable copy evident mark. Depending on the 
technology used to generate the copy evident watermark, the inspector device may be required to verify the presence 
of, and read the contents of, the copy evident watermark. 

[0037] As shown in Fig. 3, because the copy evidence in the fragile copy evident watermark of Level 0 varies with the 
page printed, Level 0 also protects against a blank originals attack. A blank originals attack is attempted forgery by 
copying of the original document on blank originals. Blank originals are sheets of recording material containing a preprinted 
fragile watermark However, the preprinted fragile watermark of the blank originals does not vary with the page printed. 
Thus, the presence of the non-varying preprinted fragile watermark can be detected by the visual inspector. Detecting 
of a non-varying fragile watermark establishes a document as a forgery. 

[0038] As shown in Fig. 1, trusted printers 132 or 133 can print documents having Level 1 protection. As shown in 
Table 1, Level 1 protection includes a robust invisible variable copy evident watermark with tracing information. The 
robust invisible variable copy evident watermark may be formed by any known or later developed technique for forming 
robust watermarks. Techniques for forming robust watermarks include, for example, slight vertical translations of letters 
with respect to a baseline, slight variations of spacing between letters, line indents, margins, and/or line spacings. The 
robust watermarks may also be formed by adding luminance or gray-scale noise-like patterns. 

[0039] The robust invisible variable copy evident watermark of Level 1 can be used to encode the copy evidence and 
the tracing information. The copy evidence included in the document 140 can vary with the page of the document 140 
and could include information identifying the content of the page, the page number or identifier, the author, the document 
title, the date, the time, and the originating organization. The copy evidence could also include characteristics about the 
trusted printer 1 32 or 1 33 or a unique copy number recorded by the trusted printer 1 32 or 1 33. The copy evidence can 
also include a large banner that prominently displays a warning statement, such as, for example, "This is a copy" or 
some similar warning. The tracing information may include, for example, information identifying to whom the original 
document was given, who is authorized to possess the document, and information relating to copy restrictions or other 
restrictions as to the use of the information in the document. The tracing information can be specified in Digital Property 
Rights Language. The copy evidence and tracing information are encoded in the robust invisible variable copy evident 
watermark. 

[0040] As shown in Fig. 4, the content owner provides image data from an image data source, which may be one of 
the computers 121-123 or an external data storage device, to an image processor, which may be an application stored 
on the server 1 10, to create the document 140. Copy evidence and tracing information is also provided to the image 
processor and included with the contents of the document 1 40. During image processing of the document 1 40, the copy 
evidence and the tracing information are included in the contents of the document 140. The copy evidence and the 
tracing information included in the document 1 40 may be entered by the content ownerthrough a graphical user interface 
provided on one of the display units 151-153 of one of the respective computers 121-123, or may be determined auto- 
matically by the operating system 111, the print management system 1 1 2, and/or the policy 1 1 3. 
[0041] The print management system 1 12 routes the print job to the trusted printer 132 or 133 and the document is 
printed on standard paper. As shown in Fig. 4, Level 1 provides protection against an adversary who has access to the 
original document 140 and a standard photocopier and standard paper and toner or ink. If the adversary copies the 
original document 140 on the standard photocopier using standard toner or ink and standard paper, a visual inspector 
can establish the resulting copy as a forgery by noting the clearly visible appearance of the robust variable copy evident 
watermark on the resulting copy. If a document appears to lack the robust variable copy evident watermark, this is 
evidence that the document may be an original, but a second tier inspection is required. 

[0042] As shown in Fig. 4, the second tier inspection can determine if a document is an original. The document is 
copied on a standard copier using standard paper. If the resulting copy contains a clearly visible watermark, the original 
document can be verified as an original. 
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[0043] As shown in Table 1, Level 1 provides protection against an adversary that can remove the robust variable 
copy evident watermark by, for example, scanning the document and removing or deleting the watermark during image 
processing. As shown in Table 1 and Fig. 4, Level 1 also provides protection against blank originals attacks. Level 1 
also protects against a compromised tracing attack, where the adversary intercepts or tampers with the source of the 
tracing information. The trusted printer 1 32 or 1 33 may be an standard color printer provided that may use special toner 
or ink including, for example, fluorescing toner or ink. 

[0044] As shown in Fig. 1, the trusted printer 133 can print documents having Level 2 protection. As shown in Table 
1 , Level 2 protection includes a fragile variable fluorescing invisible copy evident watermark with tracing information. 
The copy evidence may include the text of the page offset by some distance, but in any event depends on the contents 
of the page. The copy evidence and the tracing information may be encoded in the fragile variable fluorescing invisible 
copy evident watermark. As shown in Fig. 5, the document, including the contents, the copy evidence and tracing 
information, is printed by the trusted printer 1 33 on standard paper using a special toner or ink. The special toner or ink 
is invisible fluorescing toner or ink. As shown in Table 1, the trusted printer 133 can be a standard highlight or color 
printer that is supplied with the fluorescing invisible toner or ink. A sensor on the output of the printer could verify that 
the copy-evident mark is properly printed. 

[0045] The variable nature of the copy-evident mark prevents a blank originals attack where the adversary pre-proc- 
esses the paper by putting the special marks on it. The identifying information also allows for tracing the source of the 
unauthorized copy action. That is, the underlying information identifies who had custody over the original and should 
have been protecting it. The Level 2 protection might also be used to give some protection against an adversary who 
tries to tamper with the contents of the document, because the two printings on the page would be visually different 
under fluorescent light. 

[0046] As shown in Table 1 and in Fig. 5, Level 2 provides protection against an adversary who has access to the 
original document and a standard photocopier with standard toner or ink. A document can be verified as an original by 
illuminating that document with fluorescence-exciting light. If the document contains a watermark that fluoresces under 
the fluorescence-exciting light and that matches the visible contents of the page, the document can be verified as an 
original. If the document does not have a watermark, if the document contains a watermark that does not fluoresce under 
fluorescence-exciting light, or if the document contains a watermark that fluoresces but does not match the visible 
contents of the page, the document can be established as a copy. 

[0047] As shown in Fig. 1, the trusted printer 133 can print documents having Level 3 protection. As shown in Table 
1 , Level 3 protection includes a fragile variable fluorescing invisible copy evident watermark with tracing information. 
The mark includes a copy or a portion of the text of the page offset to the right by some distance and printed using 
invisible fluorescing toner. Tracing information such as printer, user, timestamp, document-id, and page number is also 
printed using the invisible ink. The information contained in the copy evident mark is digitally signed and encoded into 
a glyph code that is printed in the left margin of the page. 

[0048] As shown in Table 1 and Fig. 6, Level 3 provides protection against an adversary who can scan, image process, 
and print, and thus attempt to tamper with the content of the document, and who has access to the special ink used. 
Protection against a naive attacker is via a fluorescent detector as in Level 2 protection. Additional tamper protection 
and authenticity is provided by the digital signature encoded in the glyph code. 

[0049] Special inks and an ordinary highlight printer or an ordinary color printer can be used to print the original 
documents. Enhancements to the printer can include sensors to check that fluorescent toner is loaded and used. Addi- 
tionally, a sensor on the output of the printer can be used to verify that the copy evident mark is properly printed. A 
fluorescence-exciting light source can be used to expose the copy evident mark and a fluorescent light scanner can be 
used to read the information printed in fluorescent ink. This method is backward compatible with Level 2 protection. 
[0050] As shown in Fig. 6, a document may be verified as an original by the presence of a fluorescent copy-evident 
mark that matches the visible contents of the page or by successful verification of the digital signature encoded in the 
glyph code. A document may be verified as a copy by the absence of the fluorescent copy evident mark. If the fluorescent 
copy evident mark exists, the document may still be verified as a copy if the digital signature cannot be successfully verified. 
[0051] As shown in Fig. 1 , the trusted printers 133 and 134 can print documents having Level 4 protection. As shown 
in Table 1 , Level 4 protection includes a fragile invisible fluorescing variable copy evident watermark to print randomly 
generated patterns. Tracing information is also included in the copy evident watermark. The random pattern of the copy 
evident mark is digitally signed and encoded into a glyph code that is printed on the page. 

[0052] As shown in Fig. 7, Level 4 provides protection against an adversary who has access to a scanner, image 
processing software, and a color printer, as well as access to the special ink used, and who may attempt to use these 
to tamper with the content of the document or to forge an acceptable copy evident mark. Additional tamper protection 
and authenticity is provided by the digital signature encoded in the glyph code. 

[0053] Special inks and an ordinary highlight printer or ordinary color printer can be used to print the original documents. 
Enhancements to the printer could include sensors to check that fluorescent toner is loaded and used. Additionally, a 
sensor on the output of the printer can be used to verify that the pattern is properly printed. A fluorescent light source 
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can be used to expose the copy evident mark. A fluorescence-exciting light scanner can be used to read the information 
printed in the fluorescent ink. 

[0054] As shown in Fig. 7, a document may be verified as an original if the fluorescent pattern measured from the 
paper matches the pattern encoded in the glyph code or by successful verification of the digital signature. A document 
may be verified as a copy by the absence of the fluorescent copy evident watermark. If the copy evident mark is present, 
the document may still be verified as a copy if the fluorescent pattern measured from the paper fails to match the pattern 
encoded in the glyph code. A document may also be verified as a copy if the digital signature cannot be successfully 
verified. 

[0055] As shown in Fig. 1, the trusted printer 134 can print documents having Level 5 protection. As shown in Table 
1 , copy evidence is provided by the use of a robust fluorescing black copy evident mark. Tracing information is encoded 
in the mark. As shown in Fig. 8, Level 5 provides protection against an adversary who uses a standard copier to make 
an unauthorized copy or attempted forgery, and who does not have access to the fluorescing ink. The equipment that 
can be used to enable Level 5 protection is fluorescing black toner in an ordinary highlight or color printer. A fluorescence- 
exciting light source can aid in the verification of the copy evident watermark. 

[0056] A document may be verified as an original by visually inspecting the document. Visual inspection reveals the 
fluorescing black copy evident mark. A document may be verified as a copy by the absence of the copy evident mark, 
or a copy evident mark printed in ordinary ink. 

[0057] As shown in Fig. 1, the trusted printer 134 can print documents having Level 6 protection. As shown in Table 
1, copy evidence is provided by the use of a robust fluorescing black copy evident mark. For example, such as mark 
could be created by printing fluorescing invisible ink over ordinary black ink. The fluorescent black ink is used to print 
fixed portions of the document contents (the portion selected to be printed in this way does not depend on the document 
contents). Tracing information can also be encoded in the mark. As shown in Fig. 9, Level 6 provides protection against 
an adversary who uses a plain copier to make an unauthorized copy or attempted forgery and who does not have access 
to the special ink. Level 6 also protects against an adversary with physical access to the trusted printer that detaches 
the fluorescing toner, since this would cause portions of the printed page to disappear. 

[0058] The equipment that can be used to provide Level 6 protection includes fluorescing black toner or ink in an 
ordinary highlight or color printer or a combination of fluorescing invisible ink and ordinary black ink. A special viewer 
can be used to detect and verify the correct pattern of the copy evident watermark. 

[0059] As shown in Fig. 9, a document may be verified as an original by visually inspecting the document to verify 
that the entire contents of the document page have been printed. A special viewer may be used to verify that part of the 
visible contents of the document fluoresces or to verify the correct fluorescent pattern. A document may be verified as 
a copy by visually inspecting the document. If a portion of the page has not been printed, the document can be verified 
as a copy. If the entire page has been printed, the document may be verified as a copy by the absence of the fluorescing 
black copy evident mark, or by the existence of a non-fluorescing copy evident mark. A document may be verified as a 
copy if the special viewer reveals an incorrect fluorescing pattern in the copy evident mark. 

[0060] As shown in Fig. 1 , the trusted printers 134 and 135 can print documents having Level 7 protection. As shown 
in Table 1 , Level 7 protection includes a robust fluorescent black variable copy evident watermark. As shown in Fig. 1 0, 
the fluorescent black toner or ink is used to print randomly selected portions of the content of the document. The 
information about which pattern is used is encrypted and encoded as a glyph code that is printed on the document using 
a key that is known to the trusted printers 134 and 135 and to an inspector device. The inspector device can read the 
glyph code, decode the glyph code to get the encrypted pattern information, and decrypt the pattern information. The 
copy evidence and the tracing information are also encoded in the watermark. 

[0061 ] As shown in Fig. 1 0, Level 7 provides protection against an adversary that has access to an original document 
and the trusted printer 134 or 135 but does not have access to the fluorescent black toner or ink. Level 7 also protects 
against an attacker with physical access to the trusted printer that detaches the fluorescing toner, since this would cause 
portions of the printed page to disappear. Level 7 also protects against an attacker who has a scanner and an image 
processor. 

[0062] Verification of a document as an original can be done using fluorescence-exciting light. If portions of the doc- 
ument fluoresces when exposed to fluorescence-exciting light, this is evidence that the document may be an original. 
Asecond tier inspection is necessary. The inspector device verifies thatthe decrypted glyph-encoded information matches 
the fluorescent pattern. If portions of the document are missing, the document can be verified as a copy. If the entire 
document is printed but has no watermark or a black watermarkthat does not fluoresce, the document can be established 
as a copy. If the document has fluorescent portions but the decrypted glyph encoded information does not match the 
fluorescent pattern, the document can be established as a copy. If the decoded, decrypted pattern information matches 
the detected pattern, the document can be verified as an original. 

[0063] The trusted printers 1 34 and 1 35 can be standard highlight or color printers provided with fluorescent black toner. 
[0064] As shown in Fig. 1 , the trusted printers 134 and 135 can print documents having Level 8 protection. As shown 
in Table 1, Level 8 protection includes a robust fluorescing black variable copy evident watermark to print content 



9 



EP 1 209 897 B1 



dependent portions of the document, with tracing information that is encrypted given a key known to the printer and to 
the inspector device and glyph encoded. The watermark includes selected portions of the document's contents that are 
printed in fluorescing black toner or ink. The selected portions are selected as a function of the document's content. 
Information about the user and about the trusted printer 134 or 135 and the fluorescing pattern are encrypted and 
encoded in a glyph code that is printed on the document. 

[0065] As shown in Table 1 , Level 8 provides protection against an adversary that has access to the original document 
and a standard copier and standard toner or ink. As shown in Fig. 1 1 , Level 8 also protects against an adversary that 
has access to the original document, a scanner, an image processor and the trusted printer 134 or 135 and who tries 
to alter the tracing information. Even if the attacker tries to alter the tracing information, the attacker doesn't know the 
key to encrypt or decrypt the tracing information. Level 8 also protects against a detached toner attack, since this would 
cause portions of the printed page to disappear. 

[0066] Establishing a document as a copy can also be done by a visual inspection. If portions of the printed document 
are missing, the document can be established as a copy. If the entire document is printed but has no visible watermark 
or a visible watermark that does not fluoresce; the document can be established as a copy. A second tier inspection 
determines if the pattern information that is decoded and decrypted from the glyph code by the inspector device matches 
the fluorescent pattern detected by a fluorescent light scanner. If the decoded, decrypted pattern information matches 
the detected pattern, the document can be verified as an original. 

[0067] The trusted printers 134 and 135 can be standard highlight or color printers provided with fluorescent black 
toner. A fluorescent light scanner can be used to detect the fluorescent pattern and an inspector device can be used to 
read the glyph, decode the glyph to get the encrypted pattern information, decrypt the pattern information and match 
the pattern information against the detected fluorescent pattern. 



Claims 

1 . A document forgery protection printing method comprising: 

processing (S1 1 00) an image of a document; 

determining (S1500) forgery protection requirements for.the document to be printed; 

determining (S1 600) a protection level to be applied to the document based on the determined forgery protection 
requirements; and 

based on the determined protection level, printing (S2000) at least one watermark on the document that corre- 
sponds to the determined protection level using a printer, characterised in that the forgery protection require- 
ments for the document to be printed are determined from a set of different potential requirements; 
in that the protection level is determined (S1 600) from a set of different protection levels based on the determined 
forgery protection requirements; and 

in that the method further comprises selecting a printer from a plurality of printers that can print the document 
in accordance with the required level of protection and using the selected printer to print the at least one 
watermark. 

2. A method according to claim 1 , wherein the watermark comprises random generated patterns printed using invisible 
fluorescing toner or ink. 

3. A method according to claim 1 or claim 2, wherein the watermark is printed using fluorescing black toner or ink. 

4. A method according to claim 3, wherein the watermark comprises fixed portions or random portions of each page 
or content dependent portions of each page printed using the fluorescing black toner or ink. 

5. A method according to claim 2 or claim 4, wherein the randomly generated patterns or random portions of each 
page are encoded in a glyph and preferably digitally signed. 

6. A document forgery protection printing system, comprising: 

at least one image processor that processes an image of a document including at least one page; 
at least one server (110) having a print management system (112) adapted to implement a policy (113) that 
determines a forgery protection level for the document in accordance with forgery protection requirements for 
the document; 

a plurality of printers (131-135), each printer adapted to print the document and to apply at least one protection 
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level to the document by printing at least one watermark including copy evidence and tracing information on 
the document that corresponds to the determined protection level, characterised in that said policy is adapted 
to determine the forgery protection requirements for the document from a set of different potential requirements; 
in that the protection level is determined from a set of different protection levels based on the determined forgery 
protection requirements; and 

in that said print management system (1 12) is adapted to select a printerfrom the plurality of printers (131-135) 
to print the at least one watermark in accordance with the required level of protection. 

7. A system according to claim 6, wherein the copy evidence and/orthe tracing information is encoded in the watermark. 

8. A system according to claim 6 or claim 7, wherein the copy evidence varies with each page of the document. 

9. A system according to any one of claim 6 to 8, wherein the watermark comprises the contents of each page printed 
using invisible fluorescing toner or ink and offset from the visible contents of each page. 

10. A system according to any one of claims 6 to 9, wherein the tracing information is digitally signed and encoded in 
a glyph and printed using invisible fluorescing toner or ink and located in a margin of each page. 



Patentanspriiche 

1. Druckverfahren fur Dokumenten-Falschungsschutz, umfassend: 

Verarbeiten (S1 100) eines Bildes eines Dokuments, 

Bestimmen (S1500) von Falschungsschutzanforderungen fur das zu druckende Dokument, 

Bestimmen (S1600) eines Schutzgrades, der auf das Dokument anzuwenden ist, auf Basis der bestimmten 

Falschungsschutzanforderungen und 

Drucken (S2000), auf Basis des bestimmten Falschungsschutzgrades, wenigstens eines dem bestimmten 
Schutzgrad entsprechenden Wasserzeichens auf das Dokument unter Verwendung eines Druckers, dadurch 
gekennzeichnet, dass die Falschungsschutzanforderungen fur das zu druckende Dokument aus einer Gruppe 
von verschiedenen moglichen Anforderungen bestimmt werden, 

dadurch, dass der Schutzgrad auf Basis der bestimmten Falschungsschutzanforderungen aus einer Gruppe 
von verschiedenen Schutzgraden bestimmt (S1600) wird, und 

dadurch, dass das Verfahren des Weiteren das Auswahlen eines Druckers aus einer Vielzahl von Druckern, 
der das Dokument in Ubereinstimmung mit dem erforderlichen Schutzgrad drucken kann, und das Verwenden 
des gewahlten Druckers zum Drucken des wenigstens einen Wasserzeichens umfasst. 

2. Verfahren nach Anspruch 1, wobei das Wasserzeichen zufallig erzeugte Muster umfasst, die unter Verwendung 
von unsichtbarem fluoreszierendem Toner oder unsichtbarer fluoreszierender Tinte gedruckt werden. 

3. Verfahren nach Anspruch 1 oder 2, wobei das Wasserzeichen unter Verwendung von fluoreszierendem schwarzem 
Toner oder von fluoreszierender schwarzer Tinte gedruckt wird. 

4. Verfahren nach Anspruch 3, wobei das Wasserzeichen feststehende Bereiche oder zufallige Bereiche jeder Seite 
oder inhaltsabhangige Bereiche jeder Seite, gedruckt unter Verwendung von fluoreszierendem schwarzem Toner 
oder von fluoreszierender schwarzer Tinte, umfasst. 

5. Verfahren nach Anspruch 2 oder 4, wobei die zufallig erzeugten Muster oder zufalligen Bereiche jeder Seite in eine 
Glyphe codiert und bevorzugt digital signiert sind. 

6. Drucksystem fur Dokumenten-Falschungsschutz, umfassend: 

wenigstens einen Bildprozessor, der das Bild eines Dokuments verarbeitet, das wenigstens eine Seite enthalt, 
wenigstens einen Server (1 1 0) mit einem Druckverwaltungssystem (1 1 2), der eingerichtet ist, urn ein Verfahren 
(1 1 3) zu implementieren, das in Ubereinstimmung mit Falschungsschutzanforderungen fur das Dokument einen 
Falschungsschutzgrad fur das Dokument bestimmt, 

eine Vielzahl von Druckern (131 bis 135), wobei jeder Drucker eingerichtet ist, urn das Dokument zu drucken 
und durch Drucken auf das Dokument wenigstens eines Wasserzeichens, einschlieGlich Kopiernachweis und 
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Verfolgungsinformation, das dem bestimmten Schutzgrad entspricht, wenigstens einen Schutzgrad auf das 
Dokument anzuwenden, dadurch gekennzeichnet, dass das Verfahren eingerichtet ist, urn die Falschungs- 
schutzanforderungen fur das Dokument aus einer Gruppe von verschiedenen moglichen Anforderungen zu 
bestimmen, dadurch, dass der Schutzgrad auf Basis der bestimmten Falschungsschutzanforderungen aus 
einer Gruppe von verschiedenen Schutzgraden bestimmt wird, und 

dadurch, dass das Druckverwaltungssystem (1 12) eingerichtet ist, um aus einer Vielzahl von Druckern (131 
bis 135) einen Drucker zum Drucken des wenigstens einen Wasserzeichens in Ubereinstimmung mit dem 
erforderlichen Schutzgrad auszuwahlen. 

7. System nach Anspruch 6, wobei der Kopiernachweis und/oder die Verfolgungsinformation in das Wasserzeichen 
codiert ist bzw. sind. 

8. System nach Anspruch 6 oder 7, wobei sich der Kopiernachweis mit jeder Seite des Dokuments andert. 

9. System nach einem der Anspruche 6 bis 8, wobei das Wasserzeichen die Inhalte jeder Seite, gedruckt unter Ver- 
wendung von unsichtbarem fluoreszierendem Toner oder unsichtbarerfluoreszierenderTinte und versetzt von den 
sichtbaren Inhalten jeder Seite, umfasst. 

10. System nach einem der Anspruche 6 bis 9, wobei die Verfolgungsinformation digital signiert und in eine Glyphe 
codiert ist und unter Verwendung von unsichtbarem fluoreszierendem Toner oder unsichtbarer fluoreszierender 
Tinte und angeordnet in einem Rand jeder Seite gedruckt ist. 



Revendications 

1. Procede d'impression a protection contre la falsification de documents comprenant: 

traiter (S1 1 00) une image d'un document; 

determiner (S1500) des exigences de protection contre la falsification pour le document a imprimer; 
determiner (S1600) un niveau de protection a appliquer au document sur la base des exigences de protection 
contre la falsification determinees; et 

sur la base du niveau de protection determine, imprimer (S2000) au moins un filigrane sur le document qui 
correspond au niveau de protection determine en utilisant une imprimante, caracterise en ce que les exigences 
de protection contre la falsification pour le document a imprimer sont determinees a partir d'un ensemble 
d'exigences potentielles differentes; 

en ce que le niveau de protection est determine (S 1600) a partir d'un ensemble de niveaux de protection 
differents selon les exigences de protection contre la falsification determinees; et 

en ce que le procede comprend en plus le fait de selectionner une imprimante parmi une pluralite d'imprimantes 
qui peut imprimer le document selon le niveau requis de protection et en utilisant I'imprimante selectionnee 
pour imprimer le au moins un filigrane. 

2. Procede selon la revendication 1 , dans lequel lefiligrane comprend des motifs generes de maniere aleatoire imprimes 
en utilisant un toner ou une encre fluorescente invisible. 

3. Procede selon la revendication 1 ou la revendication 2, dans lequel le filigrane est imprime en utilisant un toner ou 
une encre noire fluorescente. 

4. Procede selon la revendication 3, dans lequel le filigrane comprend des parties fixees ou des parties aleatoires de 
chaque page ou des parties dependant du contenu de chaque page imprimee en utilisant le toner ou I'encre noire 
fluorescente. 

5. Procede selon la revendication 2 ou la revendication 4, dans lequel les motifs generes de maniere aleatoire ou les 
parties aleatoires de chaque page sont encodees dans un glyphe et de preference signees de maniere numerique. 

6. Systeme d'impression a protection contre la falsification de documents, comprenant: 

au moins un processeur d'images qui traite une image d'un document incluant au moins une page; 

au moins un serveur (110) ayant un systeme de gestion d'impression (112) adapte pour implementer une regie 
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(113) qui determine un niveau de protection contre la falsification pour le document selon des exigences de 
protection contre la falsification pour le document; 

une pluralite d'imprimantes (131-1 35), chaque imprimante adaptee pour imprimer le document et pour appliquer 
au moins un niveau de protection au document en imprimant au moins un filigrane incluant une preuve de copie 
et une information de tracage sur le document qui correspond au niveau de protection determine, caracterise 
en ce que ladite regie est adaptee pour determiner les exigences de protection contre la falsification pour le 
document a partir d'un ensemble d'exigences potentielles differentes; 

en ce que le niveau de protection est determine a partir d'un ensemble de niveaux de protection differents sur 
la base des exigences de protection contre la falsification determinees; et 

en ce que ledit systeme de gestion d'impression (1 12) est adapte pour selectionner une imprimante parmi la 
pluralite d'imprimantes (131-135) pour imprimer le au moins un filigrane selon le niveau requis de protection. 

Systeme selon la revendication 6, dans lequel la preuve de copie et/ou I'information de tracage sont encodees dans 
le filigrane. 

Systeme selon la revendication 6 ou la revendication 7, dans lequel la preuve de copie varie avec chaque page du 
document. 

Systeme selon I'une quelconque des revendications 6 a 8, dans lequel le filigrane comprend le contenu de chaque 
page imprimee en utilisant un toner ou une encre fluorescente invisible et decale du contenu visible de chaque page. 

Systeme selon I'une quelconque des revendications 6 a 9, dans lequel I'information de tracage estsignee de maniere 
numerique et encodee dans un glyphe et imprimee en utilisant un toner ou une encore fluorescente invisible et situe 
dans une marge de chaque page. 
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